My Health Records Act 2012

The System Operator is authorised to use or (subject to subsection (3A)) disclose health information included in a healthcare recipient’s My Health Record if the System Operator:

has reason to suspect that unlawful activity that relates to the System Operator’s functions has been, is being or may be engaged in; and

reasonably believes that use or disclosure of the information is necessary for the purposes of an investigation of the matter or in reporting concerns to relevant persons or authorities.

The System Operator is authorised to disclose under subsection (3) only the information the relevant person or authority mentioned in paragraph (3)(b) needs to identify the matter or concerns mentioned in that paragraph with sufficient certainty to:

initiate consideration of the matter or concerns; and

if necessary, apply for an order under section 69A in relation to the matter or concerns.

If the System Operator uses or discloses personal information under this section, it must make a written note of the use or disclosure.

This section does not authorise the System Operator to use or disclose healthcare recipient‑only notes.